Third party risk management, including your vendors' vendors
Trusted by
Third party risk management, three pillars, one operator.
One Canadian team lists your vendors, ranks them, and checks what they claim. Supply chain risk is the same problem one layer out, and it is where concentration hides.
Inventory and criticality
Every third party, what it touches, and which ones could stop your business if they stopped.
Answers checked, not collected
Questionnaire responses tested against evidence, and the gaps written into the contract at renewal.
Fourth parties and concentration
Who your critical vendors depend on, and where several of yours share one provider.
Does Third-Party Risk Management work the same way in every industry?
No. The Third-Party Risk Management work is the same craft in every sector, but the conditions around it are not. In financial services that means OSFI's technology and cyber risk rules; in defence and aerospace, controlled goods rules, CMMC and the flow-down from your prime. We keep the service and change the part that bends.
B-10 expects you to evidence it, not assert it.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Your subcontractors inherit your obligations. Prove they meet them.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
What do you need from Third-Party Risk Management?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- Third-Party Risk Management
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584Third party risk management in Canada, made real.
Most programmes collect questionnaires and call it assurance. A completed questionnaire proves somebody typed.
The ranking is what makes the rest affordable.
Good work starts with an inventory and a hard ranking, because you cannot treat ninety vendors the same way and nobody has the budget to try. The question that does the sorting is simple: if this one stopped tomorrow, what stops with it? A handful will be genuinely critical, most will not, and the ranking is what makes the rest of the programme affordable. On most Canadian mid-market estates that handful is under ten. Then diligence gets proportionate. Deep on the few that matter, light and fast on the rest.
We test what a vendor claims rather than filing it.
Where a control matters, we ask for the artifact behind the answer, and where the vendor holds an attestation we read the exceptions rather than the cover page. The risk sits in two places. Contracts signed before anybody assessed anything, which is most legacy arrangements. And a register that stops at your direct suppliers while your actual exposure sits one layer further down.
What OSFI B-10 actually asks for.
The Canadian driver is specific. OSFI Guideline B-10, Third-Party Risk Management, was published 2023-04-30 and has been in effect since 2024-05-01. It reaches all federally regulated financial institutions, and it covers business and strategic arrangements broadly rather than outsourcing alone (source: OSFI, B-10). Two of its expectations get skipped almost universally: concentration risk "over multiple dimensions including geography, supplier", and the line that "the FRFI is responsible for identifying, monitoring and managing risk arising from subcontracting arrangements". If you are not federally regulated, this still reaches you through your customers' contracts.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our vendor risk assessment and vendor due diligence work runs.
Four steps, and step 01 is usually the one that surprises people. Nobody has a complete list. Procurement knows about the contracts, IT knows about the integrations, finance knows who gets paid, and the three lists disagree. We reconcile them before assessing anything, because a programme built on a partial inventory gives false comfort in exactly the places you have not looked.
Engagement phases
Phases 01 to 04
Reconcile the inventory
Contracts, integrations and payments cross-checked into one list of who you actually rely on, including the ones nobody signed off.
Rank by criticality
What each third party touches, what breaks if it stops, and which ones justify deep diligence rather than a light check.
Verify the critical few
Artifacts rather than assertions, attestation exceptions read properly, and the fourth parties behind each critical vendor named.
Fix the contracts and monitor
Security, audit rights and continuity terms written in at renewal, plus a review cadence that survives without us.
Third party risk management questions, answered straight.
Answers first, including the one where we tell you your programme is already good enough. An architect takes the call.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- RegulatedBill C-26 ReadinessBill C-26 became Bill C-8, now Canadian law, and designation starts a 90-day statutory clock.
- RegulatedISO 42001 AI Management SystemISO 42001 for Canadian organisations, from an AI system inventory to a certificate an accredited body signs.
- RegulatedQuebec Law 25 ComplianceLaw 25 Quebec compliance for Canadian businesses, where retention rules, incident registers and portability requests actually work.
